ci(release): disable cosign signing config for legacy checksum artifa… #4
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - "v*.*.*" | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: release-${{ github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| release: | |
| name: GoReleaser | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| id-token: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Set up Go | |
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Validate release tag | |
| env: | |
| REF_NAME: ${{ github.ref_name }} | |
| run: | | |
| set -euo pipefail | |
| if [[ ! "${REF_NAME}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then | |
| echo "Invalid release tag: ${REF_NAME}" >&2 | |
| exit 1 | |
| fi | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1 | |
| - name: Install Syft | |
| run: | | |
| set -euo pipefail | |
| go install github.com/anchore/syft/cmd/syft@v1.43.0 | |
| echo "$(go env GOPATH)/bin" >> "${GITHUB_PATH}" | |
| - name: Run GoReleaser | |
| uses: goreleaser/goreleaser-action@1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8 # v7.2.1 | |
| with: | |
| distribution: goreleaser | |
| version: v2.9.0 | |
| args: release --clean | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| release-smoke: | |
| name: Release smoke | |
| runs-on: ubuntu-latest | |
| needs: release | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1 | |
| - name: Smoke published GitHub release artifacts | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| REF_NAME: ${{ github.ref_name }} | |
| GITHUB_REPOSITORY: ${{ github.repository }} | |
| run: bash scripts/smoke-release-archive.sh "${REF_NAME}" | |
| npm: | |
| name: NPM package | |
| runs-on: ubuntu-latest | |
| needs: release-smoke | |
| if: ${{ vars.NPM_PUBLISH == 'true' }} | |
| environment: npm-publish | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Node | |
| uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0 | |
| with: | |
| node-version: 24 | |
| registry-url: https://registry.npmjs.org | |
| cache: npm | |
| cache-dependency-path: packages/npm/package-lock.json | |
| - name: Prepare npm package version | |
| env: | |
| REF_NAME: ${{ github.ref_name }} | |
| run: | | |
| set -euo pipefail | |
| version="${REF_NAME#v}" | |
| cd packages/npm | |
| npm ci --ignore-scripts --no-audit | |
| npm version --no-git-tag-version "${version}" | |
| npm test | |
| npm audit --audit-level=moderate | |
| package_tarball="$(npm pack --silent)" | |
| npm pack --dry-run | |
| tmp_prefix="$(mktemp -d)" | |
| trap 'rm -rf "${tmp_prefix}"' EXIT | |
| npm install --global --prefix "${tmp_prefix}" "./${package_tarball}" | |
| PATH="${tmp_prefix}/bin:${PATH}" nightward --version | |
| PATH="${tmp_prefix}/bin:${PATH}" nw --version | |
| - name: Publish npm package | |
| run: npm publish --access public --provenance | |
| working-directory: packages/npm |